In many computer systems, system profiling is used as a method of detecting system anomalies. Events, states, and actions that occur within the system are monitored and recorded during a learning period, and a behavioral profile is generated based at least in part on the events, states, and actions recorded during the learning period. The behavioral profile includes values and statistics that describe the behavior of the system when partitioned along various behavioral dimensions. For example, a profile for monitoring requests to a web service may describe the system along two behavioral dimensions: a requester identity associated with each request, and a geolocation for the origin of each request. Deviations from the behavioral profile can indicate an anomaly such as a security breach, hardware fault, or other error.
While appropriate partitioning of the information helps to create behavioral profiles that achieve various anomaly detection goals, incorrect partitioning can result in loss of valuable information that could be captured with appropriate partitioning. As a result, proper partitioning of information for anomaly detection is an important problem.